Getgrav Grav up to 2.0.21 Twig Content Sandbox assertSandboxDumpSafe Source sandbox

Summaryinfo

A vulnerability identified as problematic has been detected in Getgrav Grav up to 2.0.21. Affected by this vulnerability is the function GravExtension::assertSandboxDumpSafe of the component Twig Content Sandbox. The manipulation of the argument Source leads to sandbox. This vulnerability is listed as CVE-2026-92917. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Getgrav Grav up to 2.0.21 and classified as problematic. This issue affects the function GravExtension::assertSandboxDumpSafe of the component Twig Content Sandbox. The manipulation of the argument Source with an unknown input leads to a sandbox vulnerability. Using CWE to declare the problem leads to CWE-265. Impacted is confidentiality. The summary by CVE is:

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-92917 since 09/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1611 for this issue.

Upgrading to version 2.0.22 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Getgrav

Name

• Grav

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion